Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

11. QUALIFICATION, SITE ACCEPTANCE 6. Comments on the relevance of this AND SURVEILLANCE TESTING material to EDG selection/operation.

Learning Objectives NOTE: Principle design and application criteria for EDG units in nuclear power The primary objectives for this lesson are to plants are listed in Clause 4 and Table 1 of present the tests that EDGs are subjected IEEE 387-1995. Chapter 1 of this Manual to: (1) during their initial "type qualification" introduced the fundamental goal of 4000 for nuclear service, (2) by the EDG EDG starts and 6000 operating hours over supplier, upon installation at the site, to a service life of 40 years. Other important demonstrate compliance with the purchase design criteria include the maximum and contract, (3) as part of the licensee's pre- minimum temperatures and humidity to operational tests to verify performance and which equipment will be exposed, seismic develop baseline data, and (4) during response spectra, radiation, barometric regular surveillance runs by the licensee. A pressure (altitude), potential contamination typical surveillance run will be outlined, of combustion air or support systems by including the control of KW and KVAR load salt spray / sand / dust, the service water with the EDG connected to the grid. To quality and temperature, and also the effect reinforce this material, the lesson will then of potential events such as severe weather conclude with some comments about EDG and possible actuation of the fire protection selection, plus operational examples that system. The focus of this Chapter is on help explain the relevance of these tests to EDG testing but some of the above design actual operations. criteria are factors in the case histories discussed in other parts of this Manual. Upon completing this lesson, students will have a better understanding of: 11.1 EDG Type Qualification Tests for Nuclear Service 1. How EDGs are type-qualified for nuclear power plant service. In order for a diesel generator to be used as an on-site emergency standby power 2. Installation, break-in run, inspection, source at a nuclear power plant, it must first and full load run by the EDG supplier. be "type qualified" for that service by successfully passing rigorous performance 3. The licensee's pre-operational test tests and analyses to prove it can perform program to verify EDG performance its intended function. Regulatory Guide 1.9 and establish critical baseline data. (now Revision 4, March 2007) contains the basic requirement for that and IEEE 387 4. The licensee's ongoing surveillance (1995 edition) provides detailed guidance. testing of their diesel generators. Prior qualification of an EDG of similar design is permitted to be used to reduce 5. A typical EDG surveillance run by the the testing and analysis required. Analysis licensee, including control of KW and is most often used when testing is seen as KVAR loading when on the grid. impractical or unneeded.

Rev 1/11 11-1 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

The initial "type qualification tests" for 1. Carry load equal to continuous rated EDGs are listed and discussed in Clause 6 load for time required to achieve engine of IEEE 387-1995, "Standard Criteria for temperature equilibrium, followed by: Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power 2. Carry the short-time rated load for 2 Generating Stations." Diesel generator hours and the continuous rated load for qualification tests may be performed by the 22 hours. These different loads are manufacturer or by an independent third permitted to be applied in either order. party supplier. The latter arrangement is most likely due to the manufacturer of the 3. Complete a load rejection test at the engine-generator set not maintaining an short-time load rating. Speed increase approved 1O CFR 50 Appendix B quality shall be less than 75% of the difference assurance program. Usually, qualification between nominal speed and the over- is completed by the manufacturer, prior to speed trip set-point, or 15% over the delivery of the EDG units to the plant site. nominal (60Hz) RPM, whichever is less. In a few early 1970's vintage plants, part or all of the EDG type qualification testing was 4. Complete light/no-load test equal to the conducted on-site. This was because the design light load, for allowed duration. IEEE 387 type qualification tests were not (Follow with ≥50% load for ≥0.5 hour.) formally endorsed by Regulatory Guide 1.9 until after manufacture and delivery of the Start and Load Acceptance Tests: EDGs to those early nuclear plant sites. Modified qualification testing was agreed to This is a very intense and grueling portion by the licensees and performed on-site. of the qualification tests. It requires starting and loading an EDG, or group of EDGs of 11.1.1 Three Basic "Type Qualification" the type being qualified, to verity the Tests for Nuclear Service EDGs capability to start and accept load within the time permitted by the plant design basis. A The tests outlined in Clause 6 of IEEE 387- total of 100 starts are performed, with zero 1995 will be covered in more detail later in failures permitted. (Previous editions of this Chapter. The present discussion will this Standard required 300 starts, with no serve to introduce the three basic tests that more than 3 failures.) If multiple engines are used to verify the ability of an EDG to are used, to speed up the testing, each perform its design basis mission. They are: engine must be tested for Load Capability, and Margin (the latter test is discussed on Load Capability Tests: the next page). Additional test criteria can be found in Clause 6.2.2 of IEEE 387-1995. This is to demonstrate the EDG's ability to carry the following loads at rated power This effort can also be challenging to the factor, for the periods of time indicated, to test facility, as it is very labor intensive and successfully reject a heavy load, and also takes weeks (or even months) to complete, to operate at light load (or no load) as depending on any problems or failures. An specified by the manufacturer. overview of these tests follows:

Rev 1/11 11-2 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

1. Start and achieve specified voltage and Margin Tests (transient conditions): frequency within the required time. This is a series of extra high stress tests 2. Immediately accept a single step load intended to demonstrate that the EDG has equal to or greater than 50% of the a performance safety margin for that plant's continuous kilowatt (KW) rating. design. It requires two or more loaded run tests applying loads greater than the most 3. At least 90 of these tests shall be with severe step load in the plant design profile, the EDG initially at warm-standby, with including step changes above a base load lube oil and water jacket temperatures (any steady point on the loading profile). being kept at or below the values The limiting case (worst case) step change recommended by the mfr. After load is over base load, as defined by the design applied, run until temperatures are , shall be demonstrated. stabilized at normal levels for the load. "Worst case" is not necessarily the largest 4. At least 10 of these tests shall be with single step load, as the most severe step the engine at its normal operating may be a smaller load applied as the temperatures for the load ("hot start"). EDG's full-load capability is approached. However, a margin step load at least 10% 5. Any failure requires a design review, greater than the magnitude of the most corrective action, and continuation of severe single-step load within the load the tests until reaching 100 consecutive profile is deemed sufficient for the margin starts without failure. test. The criteria for margin tests are:

NOTE: Allowance is made to disregard any 1. Demonstrate the ability of the generator, test start categorized below, and resume exciter, and automatic voltage regulator the test sequence without penalty: to accept the margin test load (usually a low , high inrush starting A. Unsuccessful attempts that are clearly current to a pump motor), without the result of operator error. generator instability resulting in voltage collapse or inability of the voltage to B. Tests performed to verify a scheduled recover. normal maintenance procedure. 2. Demonstrate the ability of the engine C. Tests performed for troubleshooting and its speed-regulating to purposes, defined as such in advance. accept that load without stalling, and to recover to normal operating speed. D. Successful start attempts which were terminated intentionally, without loading. NOTE: Frequency and voltage excursions recorded during this test may exceed those E. Failure of any temporary service system values specified for the plant design load, or any temporary hookup that will not be as this test load should never be reached in part of the permanent EDG installation. the course of normal emergency service.

Rev 1/11 11-3 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

11.1.2 Additional EDG Evaluation by seismic event. Seismic testing shall be Test or Analyses followed by functional testing to verify the relevant principle design criteria covered in Aging of Components and Assemblies: Clause 4 of IEEE 387-1995.

Clause 6 of IEEE 387-1995 introduced 11.1.3 Analysis/Test of Design Change comprehensive evaluation of ageing over to EDG Previously Qualified the design life of the EDG plant. Those components and assemblies required to Any design change or modification to a enable the unit to meet its design previously qualified EDG must be tested capabilities were deemed "safety-related." and/or analyzed "as needed" to assess the Examples include starting air solenoid impact on performance. IEEE 387 requires valves, the governor, functionally required that changes be analyzed to determine if gaskets/seals for which failure (leakage) the degree of change is major or minor: would degrade performance, and electrical cable (discussed in a subsequent chapter). Major changes to a qualified EDG, such as a difference in the number of cylinders, Other, nonsafety-related components and stroke, bore, BMEP, running speed, or how assemblies still require verification that they the engine-generator is configured shall will not degrade a safety-related function. require requalification (as if a new design). This may be done by testing, analyses, or a combination of test and analysis. Minor changes to a qualified EDG, such as component parts substitution, shall be For those components and assemblies that qualified by analysis, or testing, or both. were classified as safety-related, their age- related failure mechanism potential must be The category assigned to a (proposed) evaluated. Those with significant potential design change or modification is influenced for age-related failures must be qualified by by the use of that part or design feature in testing (preferred), analysis, or both. The other EDGs (especially of the same series) components with a qualified lifetime less and by experienced engineering judgment. than the EDG system life objective shall have a maintenance/replacement interval 11.2 "Factory" Production Testing defined. If aging by test is used, it must be followed by seismic qualification to meet Clause 5 of IEEE 387-1995 requires that IEEE 344-1987. EDGs have "factory" production tests as described below. However, these may be Seismic Qualification Requirements done by the manufacturer or the supplier, at the factory, at the assembler's facility, or Seismic qualification per IEEE 344-1987 is on-site after delivery to the NPP. Typically required for all safety-related components. the manufacturer will have run the engine Nonsafety-related components require briefly at the factory, followed by a lower analysis/test to show they will not degrade end check for potential problems, but the the EDG's safety-related function during a following tests are most often done on-site:

Rev 1/11 11-4 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

1. Initial "break-in" run as recommended • Valve train set-up and clearance. by the manufacturer. • Fuel injection component checks.

2. Load the engine as follows, using 4. Engine speed-regulating Governor set- either a dynamometer or generator: up and calibration. (These tests may be run in any order). One hour at 50% of the continuous 5. Engine over-speed Governor set-up and rating, one hour at 75%, two hours calibration. each at 100% and 110%. Log data per 5.2.1 of IEEE 387-1995. Set and 6. Engine trip and alarm relay calibrations. check engine-mounted alarms and shutdowns. Perform and document 7. Generator internal checks, including: post-test inspections per mfr's spec. • Rotor to stator gap and concentricity 3. Generator shall be tested per NEMA • Insulation resistance (megger test) MG 1-1993. • Slip ring and brush alignment, condition, and brush tension check. 11.3 Initial On-Site Set-up of EDG 8. Automatic voltage regulator set-up and Factory/supplier field service and utility calibration. personnel conduct on-site inspections, adjustment, and testing to assure the EDG 9. Generator output breaker installation will perform satisfactorily on location. If the and alignment in the cubical, trip and "factory" tests discussed in 11.2 are done auxiliary relay calibration, and auxiliary on-site, they would follow this initial set-up. contact operation checks. The tasks listed below illustrate how much is involved in a typical EDG set-up on-site: 10. Generator-Emergency (Class 1E) Bus automatic load sequencer or load 1. Remove shipping restraints and covers. sequence relay checks, calibration.

2. EDG base anchor setting followed by an 11. Engine Air start system, including: acceptance alignment of the generator and engine, verified by crankshaft web • Pressure integrity tests. deflection checks. • Relief valve tests. • Air Compressor setting, alignment, 3. Engine internal checks and inspections, and motor phase rotation checks. including: • Air Compressor capacity; confirm

time to fill the air receiver. • Internal cleaning and flushing to • Air pressure switch setpoint remove protective coatings. calibrations, including verification • Bearing clearance (including thrust) of compressor starting (low) and • Cylinder bore and clearance/gap. stopping (high) pressure settings.

Rev 1/11 11-5 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

12. Fuel Storage and transfer system, • Off-skid coolant pump setting and including the following: alignment; motor phase rotation • Pressure integrity tests (no leaks). verified (if applicable). • Pressure relief valve tests. • Coolant pump capacity verified. • Fuel oil storage tank capacity and • Coolant pump pressure switch fill level monitor calibration checks. setpoint calibrations. • Fuel filter and strainer checks. • Coolant system temperature • Off-skid fuel oil transfer pump switch setpoint calibration. setting, motor-pump alignment, • Coolant expansion tank level. and motor phase rotation checks. • Coolant quality samples taken for • Transfer pump capacity checks, analysis. where the time to fill the fuel oil day tank is confirmed. 15. Ventilation system checks, including: • Fuel Oil Day Tank Transfer Pump • Fan alignment and motor phase level control switch calibration, rotation verified. including verifying starting (low) • Fan balancing. and stopping (high) level settings. • Fan flow and distribution verified. • Verify fuel oil is per manufacturer's • Ventilation system temperature specs for site ambient conditions. switch high and low calibration. • Fuel Oil Day Tank Transfer Pump overfill ("high-high") level setpoint All the above pre-operational inspections, calibration (trip and alarm). checks, and tests are to verify that the EDG is properly assembled, anchored, and set 13. Lube oil system checks, including: up, the support systems and their controls • Pressure integrity test. are properly configured and functioning, • Relief valve setpoint test. and also that coolant, lube oil, and fuel oil • Off-skid lube oil pump setting and compliant with the specs are present in the alignment, plus (if applicable) proper quantities. At this point the EDG is motor phase rotation check. ready for initial site acceptance tests and • Lube oil pump capacity test. subsequent transfer to utility ownership. • Oil filter and strainer checks. • Lube oil system pressure switch 11.4 Site Acceptance Testing setpoint calibration. • Lube oil system temperature Upon completion of system, subsystem, switch setpoint calibration. and component level checks and tests • Lube oil sump level verified. associated with EDG initial set-up, the • Lube oil quality samples taken for following on-site acceptance tests are analysis to verify spec compliance. conducted. These are full scope tests to demonstrate the capability of the unit to 14. Cooling system checks, including: perform its intended function, as installed. • Pressure integrity tests. They are described in IEEE 387-1995 • Relief valve tests. Clause 7 and listed in Table 3.

Rev 1/11 11-6 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Starting Test: Demonstrates the capability Whereas the Site Acceptance tests formed to attain and stabilize rated frequency and the basis for the utility to consider the EDG voltage within the limits and time specified. acceptable for its initial use, and to make final payment to the manufacturer, the Pre- Load Acceptance Test: Demonstrates the Operational tests are the first regulatory- capability to accept the individual loads that based site tests in which the licensee must make up the design load at that NPP, in the legally demonstrate and document EDG desired sequence and time duration, while performance. As "Pre-Operational" implies, maintaining voltage and frequency within they are a prerequisite to declaring the site acceptable limits. operational.

Rated Load Test: Demonstrates ability to During the course of the pre-operational carry the following loads without exceeding test program, the EDG is started using all the manufacturer's design limits: (1) A load of the following methods: equal to the continuous rating, maintained • until engine temperatures reach equilibrium Manual Start pushbuttons, both from the plus one hour, followed by (2) The rated Control Room and at the EDG local short-time load, applied for two hours. control panel. • Simulated Loss-of-Offsite Power event NOTE: The short-time load is typically (LOOP), from the ESF bus "27" relays. 110% of the continuous rating and by • Simulated Safety Injection Actuation definition can be applied 2 of each 24 hours Signal (SIAS) from the Reactor (with the other 22 hours at continuous load) Protection System (RPS). without exceeding design limits or requiring • Combined LOOP and SAIS signals less time between maintenance intervals. Unlike Qualification, "Factory" and Site Electrical Tests: Verify characteristics of Acceptance testing, the Pre-Operational the generator, excitation system, voltage tests confirm proper functioning of all logic regulation system, engine governor, and circuits and controls programming. Generic the control and surveillance systems. Letter 96-01 addresses that requirement.

Subsystem Tests: Demonstrate control, NOTE: For all on-site testing, including protection, and surveillance systems are in Pre-Operational and Availability tests, accordance with requirements. follow the manufacturer's recommendations for reducing engine wear. These include 11.5 Pre-Operational EDG Testing engine pre-lube, use of keep-warm system (if provided), and a cool-down at reduced Following completion of site acceptance power following the test run. This issue will testing, pre-operational tests are performed be discussed in a later chapter, as some to demonstrate starting and operational licensees continue to subject their EDGs to adequacy of the system. These are as unnecessary stress and wear by running listed in Table 3 (reproduced herein) and rapid cold start tests with immediate heavy described in Clause 7.5 of IEEE 387-1995. step load.

Rev 1/11 11-7 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Before discussing Pre-Operational tests it NOTE: From this point forward, the Pre- may be helpful to describe the sequence of Operational tests become more demanding events that occur when offsite power is in order to more closely simulate various lost: Voltage sensing relays in the ESF bus emergency demand start scenarios and trip the related offsite power supply breaker verify control systems are properly set up. and shed non-permanent bus electrical loads. The EDG receives a start signal and Loss-of-Offsite Power (LOOP) Test: A loading is initiated when sensors report it LOOP event is simulated as follows. has reached pre-determined speed and voltage. The EDG output breaker will then • Emergency buses are de-energized and close, picking up ESF bus permanent loads the loads are shed immediately. Auxiliary contacts in the • EDG must start, attain required voltage- outbreak breakers also close, energizing frequency within acceptable limits and logic sequencers that control sequential time, energize the auto-connected shut- loading of the ESF bus by larger loads. down loads through load sequencer, and operate a minimum of 5 minutes. Reliability Test: This is to demonstrate that an acceptable level of reliability has Safety Injection Actuation Signal (SIAS) been achieved to place the new EDGs into Test: This demonstrates that on SIAS the operation. It requires a minimum of 25 EDG starts from its standby condition upon valid start and load tests without failure, on receipt of the auto-start signal, attains the each installed EDG. required voltage and frequency within limits, and operates 5 minutes at no load. Slow-Start Test: This is only to verify design frequency and voltage are attained. NOTE: During a plant emergency in which As the name implies, the unit is slowly Safety Injection cooling is required the plant brought up to speed, on a prescribed Main Turbine Generator will be off-line, due schedule that minimizes stress and wear. to loss of steam supply. The risk of grid destabilization and loss of the preferred Load-Run Test: This demonstrates basic (offsite) power supply is increased. The load-carrying capability, equivalent to 90- intent of this test is to confirm that upon an 100%, for not less than 1 hour. It may be SIAS signal the EDG will start to a running run by synchronizing the unit with the grid standby mode, ready to accept ESF bus in order to achieve the required load and loads in the event a LOOP event occurs. PF. Again, loading and unloading are That places the EDG in the best possible gradual, to minimize stress and wear. status to immediately accept loads upon breaker closure and thereby minimize the Fast-Start Test: Each EDG unit will be disruption of SI reactor cooling. started from standby conditions to verify that it reaches the required voltage and Combined SIAS and LOOP Test: This frequency within acceptable limits and time. combines the two tests immediately above, There is no loading with this test. and applies the same pass/fail criteria.

Rev 1/11 11-8 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Largest-Load Rejection Test: When the Hot Restart Test: Demonstrates capability largest single load is shed the EDG must to restart immediately after a run at full load stay within acceptable voltage-frequency has stabilized engine temperatures at their limits and also not trip out on over-speed. full load values. (This can reveal one potential failure mode: Badly leaking fuel Design Load Rejection Test: The EDG injectors in a hot engine can create a vapor must not trip out on over-speed when it lock that is sufficient to prevent a restart.) sheds a load equal to 90-100% of design loads. (There are no limits on voltage/ NOTE: As with previously described Slow frequency excursions, as this scenario Start and Fast Start tests, the Hot Restart presumes that all loads have been shed.) test does not involve applying load to the EDG. These tests just confirm that it can NOTE: Preventing over-speed trip of the achieve the running standby mode, ready EDG is critical when all loads have been to accept loads. In the running standby lost. This minimizes EDG recovery time for mode, control is as follows: restoration of service to the related ESF bus electrical loads. Once the cause for full • EDG is at rated speed and frequency, load rejection is isolated and corrected, the with frequency control on the governor. EDG output breaker can quickly be re- • Generator is at rated voltage, controlled closed to restore electrical service to the by the Automatic Voltage Regulator. ESF bus. Synchronizing Test: This demonstrates Although over-speed is an unacceptable ability to transfer emergency loads from the outcome of the load rejection test, it may EDG to normal (offsite) power. It involves occur in which case manual reset of the synchronizing the EDG with the grid, then over-speed trip latch is required. Several transferring its load back to offsite power, events have occurred as a consequence of isolating the diesel-generator unit from the failure to reset the over-speed trip latch. grid, and restoring it to standby status. Immediate trips have occurred on startup. Delayed trips have occurred when the latch Protective Trip Bypass Test: This is to was not fully reset and vibrated loose verify that protective trips are bypassed in during a run. (See IN 93-96 for details.) emergency operation as designed. In most facilities, engine over-speed and generator Endurance and Load Test: Demonstrates differential current trip are not bypassed. capability to carry heavy loads for at least 24 hours, of which 2 hours should be the Test Mode Override Test: Demonstrates short-time rating, and 22 hours is 90-100% that with the EDG operating in automatic of the continuous load rating. Voltage and test mode while connected to its bus, a frequency criteria must be met throughout. simulated SIAS overrides test mode by: Presumably the loads may be applied in either order, as is explicitly permitted for • Returning EDG to standby operation basically the same EDG qualification test, • Automatically energizing emergency Load Capability, part (2). See 11.1.1. loads from offsite power

Rev 1/11 11-9 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Independence Test: This demonstrates • Safety Injection Actuation (SIAS) that simultaneously starting and running • Combined SIAS and LOOP redundant EDG units does not result in any • Largest-Load Rejection potential common failure modes that may • Design-Load Rejection be undetectable in single-unit tests. • Endurance and Load • Hot Restart 11.6 Periodic Testing (Surveillance) • Synchronizing • Protective-Trip Bypass Periodic tests demonstrate the continued • Test Mode Override capability of the EDGs to start and accept • Independence (Verification) loads. They consist of availability, system operation, and independence verification Independence Verification Test: Following tests. See Table 3 from IEEE 387-1995, any modifications where the independence reproduced in this Chapter as Figure 11-1. of EDG units may have been affected, or at least every 10 years during plant shutdown 11.6.1 Availability Test: Each EDG unit or refueling outage, an independence shall be started and loaded at least once in verification test shall be performed. (This 31 days (slow start and load-run test, to subject will be included in the case history minimize engine stress and wear). Every discussions of Chapter 13.) 6th month, a combined Fast-Start, Load- Run test shall be done, simultaneously 11.7 Records for Each EDG Unit satisfying the Availability Test and that one semi-annual test requirement. Extensive records shall be maintained and retrievable for each EDG unit to provide a NOTE: IEEE 387-1995, Clause 7.4.2.1, can be interpreted differently. However, RG 1.9 basis for analysis of its performance, to verify assumptions made, and to extend or (2.3.2.2) makes the intent clear, as above. shorten equipment maintenance intervals

and replacement schedules. The records 11.6.2 System Operation Tests: This is must include the following, as a minimum: a series of tests to verify the ability of the

EDG to perform its intended function under a) All start attempt, maintenance, repair, simulated accident conditions. These tests and out-of-service histories, cumulative shall be performed at shutdown/refueling operating and maintenance data, statistical outages (typically once every two years). analysis of EDG test results as well as actual demand runs. The System Operation Tests listed in Table b) Critical failure mechanisms, human 3 have all been described previously in this errors, and common mode failures, with Chapter. They include the following: causes and corrective actions included. • Slow-Start c) Test parameter data in accordance • Load-Run with IEEE 387-1995, Table 4, which lists • Fast-Start minimum engine operating data that must • Loss-of-Offsite Power (LOOP) be maintained. (See Figure 11-2, herein.)

Rev 1/11 11-10 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

NOTE: All nuclear plants are required to steamline break (MSLB) than they were for have a program or measures in place to the presumptive LOOP-LBLOCA. The address corrective actions, in accordance timing of these events can also have an with 10 CFR 50, Appendix B, Criterion XVI. impact on the resulting load, depending on An effective corrective action provides the which one occurs first and the time interval means for analyzing problems, finding root between them. Furthermore, the definition causes, developing corrective actions, and of "short-time rating" is subject to some implementing solutions. interpretation, as engine manufacturers typically have several ratings higher than 11.8 Concerns about the Adequacy of "continuous" (e.g., for running intervals of Licensee Periodic (Surveillance) 2000, 4, 2, and 0.5 hours). Testing TI 2515/176 requested the collection of The NRC issued Temporary Instruction (TI) extensive data for every EDG used as an 2515 /176 in May, 2008, to address their onsite standby power supply, as the first concerns regarding the adequacy of EDG step in addressing this general concern. surveillance testing. The catalyst for this This will be a current topic for years, until action was a finding that endurance tests at completion of analyses, follow-up, and Dresden NPS did not adequately verify needed corrective action by licensees. EDG operability because test loading did not envelop the predicted design-basis 11.9 NRC Position on the Use of EDGs event (DBE) loading. The inconsistency for Peaking was subsequently identified at other sites. Further, the NRR staff also identified issues Branch Technical Position ICSB-8 (PSB), related to test loading requirements, peak "Use of Diesel Generator Sets for Peaking." design-basis loading values and durations, and EDG ratings when reviewing license The Instrument and Controls Systems amendment requests to correct endurance Branch issued this technical position in and margin testing acceptance criteria. 1981 concluding that "... the potential for Therefore, NRR staff issued the above TI common mode failure modes should to assess the extent of these issues and to preclude interconnection of the onsite and evaluate the adequacy of EDG testing as offsite power sources except for short prescribed in plant-specific TS and design periods for the purpose of load testing." bases. Clearly, the use of EDGs for peaking is EDG loading is generally designed for a strongly discouraged, if not prohibited. concurrent loss-of-offsite power and a loss Both EDG systems should never be run in of cooling accident (LOOP+LOCA). The parallel with the grid at the same time, as a loading profile for a concurrent LOOP and power line drop, a plant substation fault, or large-break (LB) LOCA is typically high. transient could take out both standby power However, at some sites the calculated load systems at the same time, leaving the values were greater for a LOOP coincident station very vulnerable to a subsequent with a small-break (SB) LOCA or a main LOOP event or other emergency.

Rev 1/11 11-11 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

11.10 Observations on EDG Control Slight changes in the EDG governor circuit When in Parallel with Grid can result in EDG speed reference signal anomalies. These are typically due to Monthly EDG Load-Run tests are usually things causing changes in governor speed accomplished by synchronizing with the reference circuit resistance, such as circuit grid in order to facilitate achieving the relay contacts and motor operating required load. Achieving the proper load potentiometers (MOPs). (90-100% of continuous), while avoiding potential problems related to running in • If the EDG speed reference signal drops parallel with the grid can sometimes pose a in relation to grid frequency, the grid challenge to the EDG operator. takes KW load off the EDG.

11.10.1 Frequency–Load Control Issues • If the EDG speed reference signal When Connected to the Grid increases in relation to grid frequency, the EDG picks up more KW load from There can be several causes for EDG the grid. Overload trip may occur. frequency-load changes or swings while connected with the grid. The EDG cannot 11.10.2 Voltage-KVAR Control Issues have significant impact on the grid but can When Connected to the Grid certainly be affected by grid changes. There can be several causes for EDG Slight grid frequency changes show up as voltage–KVAR changes or swings while KW load swings on the EDG. Therefore, connected with the grid. The primary one of the causes for EDG load swings causes for EDG KVAR swings are: while connected to the grid are slight variations in grid frequency. Obviously, Slight grid voltage changes show up as since the plant EDG operator has no direct KVA (and therefore KVAR) load changes ability to control grid frequency, slight on the EDG. Since the plant EDG operator adjustments in EDG speed governor has no direct ability to control grid voltage, reference frequency are often required over slight adjustments in EDG AVR reference the duration of the loaded run test. voltage are often required over the duration of the loaded run test, in order to maintain • If grid frequency drops in relation to the required KVAR and the directly-related EDG reference frequency, the EDG power factor (pf). picks up more grid KW load. It could trip from overload when conducting • If grid voltage drops in relation to EDG rated load and overload testing. reference voltage, the generator will take on more KVAR load from the grid. • If grid frequency increases in relation to This will result in a decrease in the EDG EDG reference frequency, the grid power factor and an increase in takes KW load off the EDG. It could trip generator output current. The generator from reverse power if synchronized and overload trip relay is sensitive to current operating at low loads. whether from KW or KVAR.

Rev 1/11 11-12 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

• If the grid voltage increases in relation more KW load. The opposite is also to EDG reference voltage, the grid true, such that steadily reducing engine relieves some of the KVAR load from power, as if attempting to slow down, the EDG. This will result in an increase takes off KW load, eventually to where or improvement in the EDG power power flow reverses and the generator factor. When operating near unity becomes a motor driven by the grid. power factor, this may cause a generator loss of field trip (LOFT). 2. The generator "feels" KVA and, as a result, KVAR load. The KVAR load is Slight changes in the EDG AVR circuit increased by the voltage regulator resulting in EDG voltage reference signal attempting to increase the generator anomalies. These anomalies are typical output voltage (via the field). Of course, due to changes in the AVR voltage it can't raise grid voltage so that simply reference circuit resistance such as circuit results in the generator picking up more relay contacts and potentiometers (PDPs). KVAR load. The reverse is also true, such that if the voltage regulator tries to • If the EDG voltage reference signal lower generator output voltage below drops in relation to grid voltage, the grid line voltage it will eventually get the field takes KVA (and, therefore, KVAR) load so low a loss-of-field trip occurs. off the EDG. This will result in an increase or improvement in the EDG 3. To prevent problems, the EDG operator power factor, which may cause LOFT. will always connect to the grid with the generator synchronized (but rotating at • If the EDG voltage reference signal a slightly higher frequency than the grid) increases in relation to grid voltage, the and with the generator output voltage EDG picks up more KVAR load from the slightly higher than grid voltage. The grid. This will result in an increase in subsequent disconnect will be made generator output current and could before getting too close to zero load. Of cause generator overload trips. course the EDG must be in "droop" mode whenever connected to the grid, The operational impact of the above can be to prevent inadvertent overload. summarized by these three statements: NOTE: Clause 4.5.2.2 of IEEE 387-1995 1. The engine "feels" KW load and is not requires that upon receipt of an emergency affected by KVAR load except to the start-diesel signal, the EDG's automatic extent that power factor impacts the control system shall provide automatic generator's efficiency. The KW load is start-up and adjustment of the speed increased by the governor attempting to (frequency) and voltage to a ready-to-load increase RPM (generator frequency) by condition in the isochronous mode. This is adding more fuel. Of course it can't, as to prevent reduced EDG performance in an the engine-driven generator is locked in emergency from being left in "droop" mode sync with the grid as long as connected at the conclusion of licensee's monthly to it, so the result is the EDG picks up surveillance testing.

Rev 1/11 11-13 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

11.11 Typical EDG Surveillance Run KW load is then gradually increased to 90- 100% of continuous for a period of not less Following completion of pre-operational than one (1) hour. The increase in load on testing and licensing, EDG surveillance the EDG is accomplished by adjusting the testing is required by Plant Technical governor speed reference potentiometer Specifications to ensure acceptable (MOP) that will attempt to increase engine continued performance and reliability. speed. However, since EDG speed is limited and locked by grid frequency while EDG Starting: operating in parallel, the increase in fuel demand to the cylinders simply results in The EDG is started, briefly warmed up, and the EDG accepting more load from the grid. gradually raised to rated speed. Therefore, as the governor speed reference MOP is adjusted: EDG Loaded Run: • The governor repositions fuel racks to NOTE: To protect the EDG while paralleled uniformly increase fuel to all the to the grid, the governor control is placed in cylinders. • the droop mode. In droop mode, with the However, EDG speed cannot increase governor at a given speed reference point, as it is synchronized with the grid. an increase in load application to the EDG • Therefore, instead of an EDG speed tends to allow a decrease in EDG speed, increase, load is uniformly increased on thereby limiting new load acceptance. all EDG cylinders. In this manner, load Therefore, with the governor in the droop is gradually increased, often in steps, mode, a deliberate change in the governor until reaching nominal rated EDG load. speed reference point is required to • Engine temperatures are monitored and increase or decrease EDG load. the test continued for 1 hour min., or until temperatures stabilize at full load. The EDG is synchronized and paralleled • The EDG is loaded and unloaded in with its associated ESF emergency bus, steps to minimize the stress and wear which is already powered from the on the unit. preferred offsite power supply (i.e. grid). • Engine, generator, and support system To do this, diesel speed is increased to the parameters are closely monitored as the point where frequency is just slightly higher test progresses. than the grid (synchroscope rotating "slowly • The generator load is monitored and in the fast direction"). Typically, the adjusted as necessary throughout the generator output breaker is closed while loaded run, while engine and generator the synchroscope is between 10 to 12 operating parameters continue to be o'clock in one of its revolutions (unit recorded as required by IEEE 387-1995 paralleled). At this point the diesel will be Clause 7.6 ("Records") and Table 4 carrying some minimal load (part of it from ("Test Parameters"), reproduced here the interconnecting 4KV bus, plus some as Figure 11-2. All such data are from the grid). required to be "retrievable" for review.

Rev 1/11 11-14 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

EDG Unloading: Securing EDG Operation:

Once EDG temperatures have stabilized, • The engine is allowed to operate for a and the EDG has been at rated load at "cool down" interval, then shut down. least 1 hour, the generator can be • The EDG engine, generator, and unloaded. The EDG is unloaded by support systems are verified properly adjusting the same governor potentiometer aligned for emergency standby in a manner that will tend to decrease the operation. engine reference speed. Generator load is thereby reduced gradually to the minimum 11.12 Observations Pertaining to EDG allowed in the following manner: Selection and Operation

Load is then gradually reduced from 90 to The general EDG criteria applied include: 100 percent to no less than10 percent of its rated load. (This compensates for meter "…continuous load rating (the 8760 hour and meter reading errors and minor rating, per IEEE-387) equal to the sum of fluctuations in frequency in order to avoid the conservatively estimated loads reverse power trips.) The decrease in load (nameplate) needed to be powered by that on the EDG is accomplished by adjustment unit at any one time plus a 10 to 15 percent of the governor speed reference margin." potentiometer (MOP) such that it will attempt to decrease engine speed. "…at no time during the loading sequence However, since EDG speed is limited and should the frequency decrease to less than locked by grid frequency while continuing to 95% of the nominal nor voltage decrease to operate in parallel the decrease in fuel less than 75% of nominal…." demand to the cylinders allows the EDG to reject most of its load back to the grid. "…frequency should be restored to within Therefore, as the governor speed reference 2% of the nominal (60 Hz) in less than 60% MOP is adjusted: of each load-sequence interval for stepload increase and less than 80% of each load- sequence interval for disconnection of • The governor repositions fuel racks to single largest load. Voltage should be uniformly decrease fuel to all the restored to within 10% of nominal within cylinders; 60% of each load-sequence (reduction) • However, the EDG speed cannot time interval." decrease, as the grid will keep the

generator in lock step with it, whether "…during recovery from transients caused generating or being driven as a motor. by the disconnection of the largest single • Therefore, EDG RPM cannot decrease, load, the speed of the diesel generator unit and load is uniformly decreased on all should not exceed the nominal speed plus cylinders, often in steps, until the EDG 75% of the difference between nominal has been unloaded to the desired KW speed and the over-speed trip setpoint, or value for disconnection from the grid. 115% of nominal, whichever is lower.

Rev 1/11 11-15 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Further, the transient following the Injection (SI) with Loss of Offsite Power complete loss of load should not cause the (LOOP) signal and the output breaker speed of the unit to attain the speed of the closes within 10 seconds. The EDG overspeed trip setpoint." accepts primary motor loads in the following sequence: Following are several simplified examples that may help demonstrate the relationship • Charging Pump rated @ 450 KW. between load application and the EDG • High Head Safety Injection Pump rated voltage and frequency. @ 300 KW. • Low Head Safety Injection (RHR) Pump Continuous Load Example: If a plant rated @ 300 KW. identifies in the design stage that the • Component Cooling Water Pump rated required loads on the emergency onsite @ 400 KW. alternating current (AC) power supply will • Essential Cooling Water Pump rated @ be 4500 KW, the minimum specified diesel 350 KW. generator continuous load rating should be • Motor Driven Auxiliary Feedwater Pump 5000 KW (or 4950 KW, rounded up for rated @ 450 KW. conservatism). This will accommodate for • Containment Spray Pump rated @ 450 slight design calculation errors without KW. exceeding diesel generator continuous rated capacity. The NPP's approaching or perhaps even exceeding their initial EDG At the point when it becomes necessary to electrical load ratings are typically earlier bring the Containment Spray (CS) Pump design and construction plants that were on line, a substantial portion of the EDGs adversely impacted by TMI backfits that rated load is already applied. This is also a increased the required loads. significant load in itself. If the diesel generator is undersized, this can cause an Load Sequencing Example: Safety undesirable transient response as the system motor loads at nuclear power plants pump motor breaker (motor contactor) is are primarily large induction motors. This closed, connecting the pump motor to the type of motor, with full voltage applied, bus being supplied by the EDG. A nominal draws a starting current five to eight times load sequence interval (point of load its rated operating current. The generator application to point of meeting acceptance and selected must have criteria) is about 3 seconds. The following sufficient capacity to support the startup of is a basic overview of what physically such equipment without adversely affecting occurs in response to this transient. the performance of other equipment already operating. The following scenario Discussion of Voltage Transient, for the may demonstrate what could happen described load application: As the motor during such conditions at a plant utilizing a contactors close, the 4KV Bus voltage pressurized water reactor. decreases (dips). This primarily occurs due to the sudden motor starting inrush current An EDG is started in response to a Safety (as much as 5 to 8 times higher than

Rev 1/11 11-16 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

nominal running current) required to Generators are rated in KVA, and the accelerate the 450KW CS Pump motor, addition of the Containment Spray Pump which is likely already under system load load will increase the KVA output of the (system demand). As a result, diesel generator closer to its rated KVA output. generator output voltage also drops. The This increase in generator load is directly EDG voltage regulator senses the voltage applied to the engine. The increased load drop and the voltage regulator acts to on the engine tends to cause it to slow restore the desired generator output down (decrease in RPM). The engine voltage (most often 4160 volts) in respond governor senses this transient reduction in to the transient. This transient response RPM and acts to move fuel racks to characteristic of the generator and increase the fuel to engine cylinders in regulator is critical in the selection process. order to restore engine RPM to what is As noted earlier, Regulatory Guide 1.9 required for 60 Hz generator output. As requires that: noted earlier, RG 1.9 requires that:

• Voltage should not drop below 75% of • The frequency not drop below 95% of nominal (3120 volts, if 4160 nominal). nominal (57 Hz). • Generator output should be capable of restoring voltage to within 90% of • Engine and governor response should nominal (in this case, 3744 volts) within be capable of restoring frequency to 60% of each load sequence interval within 2% of nominal (58.8) within 60% (i.e., 1.8 seconds for a nominal 3 of each stepload increase sequence seconds interval). interval (1.8 seconds for a 3s interval).

NOTE: For analysis of EDG frequency, If the diesel generator output, based on remember that the generator frequency is a generator or engine capabilities or both, is dependent variable of engine speed and, selected too close to system demand therefore, whenever engine speed changes requirements, the resulting transient the generator frequency is also changed in response characteristics will likely be the same proportion. unacceptable. This becomes increasingly evident when large loads are placed on the Frequency Transient Overview for the unit already carrying a substantial portion of described load application: At the same its rated load. time that the generator is reacting to restore voltage, the engine senses the Load Disconnection (reject or loss) transient in the form of decreasing unit Example: Both voltage and frequency will speed (RPM) caused by direct generator tend to increase on a loss of load. The feedback (i.e. generator load application). following scenario may demonstrate what From steady state analysis, generator could happen during the trip of the voltage will be restored to the same Centrifugal Charging Pump or the Motor nominal 4160 volts. However, there will be Driven Auxiliary Feedwater Pump at the a new higher current and KVA output. example pressurized water reactor plant.

Rev 1/11 11-17 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Voltage Transient Overview (for loss of engine speed and the over-speed trip load): As the motor contactors open, the setpoint, or 115% of nominal, whichever is 4KV Bus voltage tends to increase due to lower. (At 115% speed the generator the sudden reduction in current required to frequency would be 115% of 60Hz, operate the 450 KW pump motor. As a resulting in 69Hz output.) Engine and result, generator output terminal voltage governor response should be capable of also increases. The voltage regulator restoring frequency to within 2% of nominal senses the voltage increase and acts to (60 ± 1.2 Hz) within 80% of the single decrease the generator voltage to the largest load disconnection sequence desired value (nominally 4160 volts) in interval (2.4 seconds when the nominal response to this transient. As noted earlier, load disconnect interval is 3 seconds). RG 1.9 requires that: Generator output should be capable of restoring voltage to EDG Governor, Speed and Frequency: within 90% of nominal (typically 4576 volts) There are two modes of governor operation within 60% of each load sequence interval applicable to most EDG applications at (1.8 seconds for a nominal 3 seconds nuclear power plants. These are referred interval). to as "isochronous" (constant speed) and "droop" (speed reduction as load increase). Frequency Transient Overview (for loss of load): If a sudden loss of a large load Governor Control Under Emergency occurs (e.g. breaker trip to one of the 450 Operation: An EDG operating in response KW motor, single largest loads, applied), to a design basis event will be connected to this loss of load will cause EDG speed an isolated 4KV Bus (i.e. isolated from the (RPM) to rapidly increase. This speed offsite grid). In this condition the desirable increase occurs since fuel racks are set to EDG governor speed control is referred to provide more fuel (meaning a higher heat, as isochronous (constant speed control). firing pressure, and power output) than In isochronous speed control, the governor required to maintain rated speed for the will attempt to maintain engine speed new (lower) load. In this case, the engine constant regardless of the load applied, so governor will sense the speed increase and the generator will provide approximately rapidly respond to move fuel racks to 60Hz power. decrease fuel delivery to the engine cylinders and restore engine RPM to the Governor Control Under Normal Test desired range (equivalent to 60 Hz). Since Operation: Frequently, for purposes of the EDG has no braking system, speed testing and restoration of power to the grid, reduction is partly dependent on the the EDG must be paralleled with the grid. remaining load and the unit's inertial (WR2) In this condition, the desirable governor characteristics. speed control characteristic is called the droop mode of operation. The generator As noted previously, Regulatory Guide 1.9 on the system grid with the highest requires that: Frequency should not exceed frequency (speed) will attempt to be the 75% of the difference between nominal lead unit (and hence, “hog system load”).

Rev 1/11 11-18 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

In the case of a diesel generator having a they are less tolerant of frequency changes nominal output of perhaps 5000 KW = 5 based on their design performance criteria. Mega Watts (MW), and synchronized to a grid with a load demand in the thousands of For example, if an accident analysis MW, trying to be the lead unit could be expects an ESF pump to have a minimum catastrophic. Therefore, whenever running design basis flow corresponding to a speed in parallel with the grid, the governor must greater than the minimum EDG frequency be in the droop mode so that its speed is allowed (frequency and engine speed being reduced slightly as the load is increased. directly related), that pump’s safety margin In droop mode the governor limits the load is eroded. Therefore, the licensee will on the EDG and how much it can increase analyze for adverse ESF load impacts in response to grid transients. associated with EDG frequency within the allowed governor speed control band. As an example, most governors are set for Occasionally this design basis analysis of a speed droop between 2.5% and 5% when ESF loads can result in establishing more going from no-load to full-load operation. stringent frequency (EDG governor speed The former results in 61.5 Hz at no load control) band limits. and the latter setting results in 63Hz at no load. For any droop setting the frequency System Load Power Factor In Generator at full load operation is a nominal 60 Hz. Selection Considerations: Generators When in parallel with the grid, the are selected and constructed in accordance governor's droop circuit is enabled and the with National Electrical Manufacturers speed regulation circuit (usually through a Association (NEMA) Standards, primarily: motor operated potentiometer or MOP) is • MG-1 used to change the "speed reference point" • MG-2 thereby enabling EDG load control. Load power factor is one of the significant Technical Specification Limits for considerations given in generator selection. Frequency and Voltage: Typical EDG Unless otherwise specified, system power Technical Specifications require the factor is assumed to be 0.8 ("lagging") for generator regulator be capable of generator selection. Since power factor is maintaining output voltage within 10% of a actually a characteristic of the system load nominal 4160 volts (4160 ± 420 volts) and and not the generator it is important that the governor to maintain engine speed the system load have a power factor of 0.8 (frequency) within 2% of 60 Hz (60 ± 1.2 lagging, or better. Simplified, power factor Hz) at steady state. These minimum EDG can be viewed as the byproduct of a performance criteria are aimed at “parasitic” system load (KVAR, or system maintaining voltage and frequency within reactive load), one that must be supplied by limits acceptable to most Engineered the generator but does no work. Safety Features (ESF) loads. However, note that some ESF loads can have more As previously noted, generators are limiting frequency requirements, meaning typically rated in KVA with this associated

Rev 1/11 11-19 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

limiting load power factor (pf) applied to determine the theoretical “true” or “real” power available to operate loads. In many cases, since load power factor is better than 0.8 (lagging), available “true” power is higher than rated. An expected “worst case” load power factor is specified or assumed in order to establish the generator characteristic “design point” that will determine its system transient and full load response capabilities.

As discussed in an earlier chapter, power factor can be expressed several different ways and one common method of expression is true power (KW) over apparent power (KVA) or (PF = KW/KVA). Another way to define power factor is the amount by which the generator current lags the output voltage. Regardless, most emergency diesel generators are designed to accommodate a 0.8 lagging system power factor at the rated KW output. For example, a generator required to supply 5000 KW to an isolated 4KV bus operating @ a 0.8 power factor (PF = 0.8), requires a generator KVA rating of 5000/0.8, or 6250 KVA.

NOTE: Most plant 4KV systems actually have power factors of 0.85 or better.

Rev 1/11 11-20 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Figure 11-1 IEEE 387-1995, Table 3, Site Testing of EDGs

Rev 1/11 11-21 of 22 USNRC HRTD Emergency Diesel Generator Qualification, Site Acceptance, and Surveillance Testing

Figure 11-2 IEEE 387-1995, Table 4, Test Parameters (Required Data)

Rev 1/11 11-22 of 22 USNRC HRTD